SUS vs. Automatic Updates

I run a SUS server at my office, and I think it is much better to do it this way then just letting the clients pull from Microsoft.
You can check the logs from the SUS server, and see if all patches were pulled from all clients, and installed correctly.
If a client doesn't pull down a specific patch, you will be able to tell in the SUS logs. Really useful, this.
Plus, you can set up your SUS server to manually approve of all patches before they are made available to your SUS clients. This way, when new patches come out, you can put them on a test machine, and make sure the patch doesn't break anything. THEN approve the patch on the SUS server for all clients. If the clients pull from Windows Update, then as soon as a patch is out, they get it; if the patch has problems, then you won't have any time to find out. Suddenly, all of your clients would be broken.
So, the SUS server is good to run if you can, IMHO.

couldn't agree more with Joe. We do the same thing.

side note: With the new worms that are broadcast based, keeping workstations that access the internet patched up is a litle more work but being able to test out patches, hotfixes and the lot BEFORE deployment sure beats the heck out of dodging paper wads and having to hunch ones shoulders at boos cuz a damn patch screwed things up.

Definately go down the SUS route - MS has just released XP SP2 - as part of the lovely new Service Pack which is delivered via Windows Updates, it first, among other things firewalls the network connection causing the workstation to slow down by about 25%, it can also play havoc with other stuff - definately test first and then choose what your users can have - more work upfront, but once it's setup and ok, a lot less of a headache in terms of user support - esp with big updates like SP2 THAT CAN'T BE REMOVED AFTERWARDS.